{"push_id":1557679790,"size":28,"distinct_size":28,"ref":"refs/heads/aosp-7.0","head":"2cf78333918b1db7aba53a3abe4938a0fb252d28","before":"586f6f759cbffb181bdbd4e77bcf1dd8170e8443","commits":[{"sha":"5545fd3f739a5c79a1c74baca5a42998449a1b4f","author":{"name":"hak86","email":"44f412f43d2240ce07a904776141162f53c1f606@gmail.com"},"message":"SELinux: Update policy version to support constraints info\n\nUpdate the policy version (POLICYDB_VERSION_CONSTRAINT_NAMES) to allow\nholding of policy source info for constraints.","distinct":true,"url":"https://api.github.com/repos/hak86/android_kernel_huawei_hi6210sft/commits/5545fd3f739a5c79a1c74baca5a42998449a1b4f"},{"sha":"a932bbbda63d45983c77b58dded3d4e57269564f","author":{"name":"hak86","email":"44f412f43d2240ce07a904776141162f53c1f606@gmail.com"},"message":"PATCH 5/5] pstore: selinux: add security in-core xattr\n support for pstore and debugfs\n\n- add \"pstore\" and \"debugfs\" to list of in-core exceptions\n- change fstype checks to boolean equation\n- change from strncmp to strcmp for checking","distinct":true,"url":"https://api.github.com/repos/hak86/android_kernel_huawei_hi6210sft/commits/a932bbbda63d45983c77b58dded3d4e57269564f"},{"sha":"c81a0e5535b91d549a9566b74471971d565cfc53","author":{"name":"hak86","email":"44f412f43d2240ce07a904776141162f53c1f606@gmail.com"},"message":"selinux: reduce the number of calls to synchronize_net() when\n flushing caches\n\ncommit 615e51fdda6f274e94b1e905fcaf6111e0d9aa20 upstream.\n\nWhen flushing the AVC, such as during a policy load, the various\nnetwork caches are also flushed, with each making a call to\nsynchronize_net() which has shown to be expensive in some cases.\nThis patch consolidates the network cache flushes into a single AVC\ncallback which only calls synchronize_net() once for each AVC cache\nflush.","distinct":true,"url":"https://api.github.com/repos/hak86/android_kernel_huawei_hi6210sft/commits/c81a0e5535b91d549a9566b74471971d565cfc53"},{"sha":"6ce417b7cc538f50c5601516ca1d2140c993407d","author":{"name":"hak86","email":"44f412f43d2240ce07a904776141162f53c1f606@gmail.com"},"message":"selinux: put the mmap() DAC controls before the MAC controls\n\ncommit 0909c0ae999c325b9d34c6f4710f40730ae3bc24 upstream.\n\nIt turns out that doing the SELinux MAC checks for mmap() before the\nDAC checks was causing users and the SELinux policy folks headaches\nas users were seeing a lot of SELinux AVC denials for the\nmemprotect:mmap_zero permission that would have also been denied by\nthe normal DAC capability checks (CAP_SYS_RAWIO).\n\nExample:\n\n # cat mmap_test.c\n  #include <stdlib.h>\n  #include <stdio.h>\n  #include <errno.h>\n  #include <sys/mman.h>\n\n  int main(int argc, char *argv[])\n  {\n        int rc;\n        void *mem;\n\n        mem = mmap(0x0, 4096,\n                   PROT_READ | PROT_WRITE,\n                   MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED, -1, 0);\n        if (mem == MAP_FAILED)\n                return errno;\n        printf(\"mem = %p\\n\", mem);\n        munmap(mem, 4096);\n\n        return 0;\n  }\n # gcc -g -O0 -o mmap_test mmap_test.c\n # ./mmap_test\n mem = (nil)\n # ausearch -m AVC | grep mmap_zero\n type=AVC msg=audit(...): avc:  denied  { mmap_zero }\n   for pid=1025 comm=\"mmap_test\"\n   scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023\n   tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023\n   tclass=memprotect\n\nThis patch corrects things so that when the above example is run by a\nuser without CAP_SYS_RAWIO the SELinux AVC is no longer generated as\nthe DAC capability check fails before the SELinux permission check.","distinct":true,"url":"https://api.github.com/repos/hak86/android_kernel_huawei_hi6210sft/commits/6ce417b7cc538f50c5601516ca1d2140c993407d"},{"sha":"3a0c3da7a71b4a1ab1953a8b9f1383e1bea269bc","author":{"name":"hak86","email":"44f412f43d2240ce07a904776141162f53c1f606@gmail.com"},"message":"selinux: make the netif cache namespace aware\n\nWhile SELinux largely ignores namespaces, for good reason, there are\nsome places where it needs to at least be aware of namespaces in order\nto function correctly.  Network namespaces are one example.  Basic\nawareness of network namespaces are necessary in order to match a\nnetwork interface's index number to an actual network device.\n\nThis patch corrects a problem with network interfaces added to a\nnon-init namespace, and can be reproduced with the following commands:\n\n [NOTE: the NetLabel configuration is here only to active the dynamic\n        networking controls ]\n\n # netlabelctl unlbl add default address:0.0.0.0/0 \\\n   label:system_u:object_r:unlabeled_t:s0\n # netlabelctl unlbl add default address:::/0 \\\n   label:system_u:object_r:unlabeled_t:s0\n # netlabelctl cipsov4 add pass doi:100 tags:1\n # netlabelctl map add domain:lspp_test_netlabel_t \\\n   protocol:cipsov4,100\n\n # ip link add type veth\n # ip netns add myns\n # ip link set veth1 netns myns\n # ip a add dev veth0 10.250.13.100/24\n # ip netns exec myns ip a add dev veth1 10.250.13.101/24\n # ip l set veth0 up\n # ip netns exec myns ip l set veth1 up\n\n # ping -c 1 10.250.13.101\n # ip netns exec myns ping -c 1 10.250.13.100","distinct":true,"url":"https://api.github.com/repos/hak86/android_kernel_huawei_hi6210sft/commits/3a0c3da7a71b4a1ab1953a8b9f1383e1bea269bc"},{"sha":"25006518c342dbb5b8f47f7f361805ad8e4a9234","author":{"name":"hak86","email":"44f412f43d2240ce07a904776141162f53c1f606@gmail.com"},"message":"selinux: Remove obsolete selinux_audit_data initialization.\n\nCommit 899838b25f063a94594b1df6e0100aea1ec57fac eliminated the need\nto initialize selinux_audit_data except in the slow path, when it is\nhandled by slow_avc_audit().  That commit removed all other initializations\nof selinux_audit_data but this one remained since the binder security\nhooks are not yet upstream (posted them to linux-kernel today).","distinct":true,"url":"https://api.github.com/repos/hak86/android_kernel_huawei_hi6210sft/commits/25006518c342dbb5b8f47f7f361805ad8e4a9234"},{"sha":"8bf4a297cd9e4e5a6a3e71212e00361dba60ffea","author":{"name":"hak86","email":"44f412f43d2240ce07a904776141162f53c1f606@gmail.com"},"message":"security: lsm_audit: add ioctl specific auditing\n\nAdd information about ioctl calls to the LSM audit data. Log the\nfile path and command number.\n\nBug: 18087110","distinct":true,"url":"https://api.github.com/repos/hak86/android_kernel_huawei_hi6210sft/commits/8bf4a297cd9e4e5a6a3e71212e00361dba60ffea"},{"sha":"6a42733a6561ff51eedeeab5ea61b802f08f902e","author":{"name":"hak86","email":"44f412f43d2240ce07a904776141162f53c1f606@gmail.com"},"message":"SELinux: per-command whitelisting of ioctls\n\nExtend the generic ioctl permission check with support for per-command\nfiltering. Source/target/class sets including the ioctl permission may\nadditionally include a set of commands. Example:\n\nallow <source> <target>:<class> { 0x8910-0x8926 0x892A-0x8935 }\nauditallow <source> <target>:<class> 0x892A\n\nWhen ioctl commands are omitted only the permissions are checked. This\nfeature is intended to provide finer granularity for the ioctl\npermission which may be too imprecise in some circumstances. For\nexample, the same driver may use ioctls to provide important and\nbenign functionality such as driver version or socket type as well as\ndangerous capabilities such as debugging features, read/write/execute\nto physical memory or access to sensitive data. Per-command filtering\nprovides a mechanism to reduce the attack surface of the kernel, and\nlimit applications to the subset of commands required.\n\nThe format of the policy binary has been modified to include ioctl\ncommands, and the policy version number has been incremented to\nPOLICYDB_VERSION_IOCTL_OPERATIONS=30 to account for the format change.","distinct":true,"url":"https://api.github.com/repos/hak86/android_kernel_huawei_hi6210sft/commits/6a42733a6561ff51eedeeab5ea61b802f08f902e"},{"sha":"ea5c5bb396739c8bc98a4563df15479916543fad","author":{"name":"hak86","email":"44f412f43d2240ce07a904776141162f53c1f606@gmail.com"},"message":"selinux/nlmsg: add XFRM_MSG_NEWSPDINFO\n\ncommit 2b7834d3e1b828429faa5dc41a480919e52d3f31 upstream (net-next).\n\nThis new command is missing.","distinct":true,"url":"https://api.github.com/repos/hak86/android_kernel_huawei_hi6210sft/commits/ea5c5bb396739c8bc98a4563df15479916543fad"},{"sha":"9f7e777aa8b0638569b08d5447c37951b62ca86b","author":{"name":"hak86","email":"44f412f43d2240ce07a904776141162f53c1f606@gmail.com"},"message":"selinux/nlmsg: add XFRM_MSG_GETSPDINFO\n\ncommit 5e6deebafb45fb271ae6939d48832e920b8fb74e upstream (net-next).\n\nThis command is missing.","distinct":true,"url":"https://api.github.com/repos/hak86/android_kernel_huawei_hi6210sft/commits/9f7e777aa8b0638569b08d5447c37951b62ca86b"},{"sha":"01ca5218c13c83406a85607ad066000d01f5893e","author":{"name":"hak86","email":"44f412f43d2240ce07a904776141162f53c1f606@gmail.com"},"message":"selinux/nlmsg: add XFRM_MSG_[NEW|GET]SADINFO\n\ncommit 5b5800fad072133e4a9c2efbf735baaac83dec86 upstream (net-next).\n\nThese commands are missing.","distinct":true,"url":"https://api.github.com/repos/hak86/android_kernel_huawei_hi6210sft/commits/01ca5218c13c83406a85607ad066000d01f5893e"},{"sha":"1e27ba2609ce849a56a084b0360c5930d1b24706","author":{"name":"hak86","email":"44f412f43d2240ce07a904776141162f53c1f606@gmail.com"},"message":"selinux/nlmsg: add XFRM_MSG_REPORT\n\ncommit b0b59b0056acd6f157a04cc895f7e24692fb08aa upstream (net-next).\n\nThis command is missing.","distinct":true,"url":"https://api.github.com/repos/hak86/android_kernel_huawei_hi6210sft/commits/1e27ba2609ce849a56a084b0360c5930d1b24706"},{"sha":"a02618c9b3b4bc090c80fa6867aa27ab8d83b066","author":{"name":"hak86","email":"44f412f43d2240ce07a904776141162f53c1f606@gmail.com"},"message":"elinux/nlmsg: add XFRM_MSG_MIGRATE\n\ncommit 8d465bb777179c4bea731b828ec484088cc9fbc1 upstream (net-next).\n\nThis command is missing.","distinct":true,"url":"https://api.github.com/repos/hak86/android_kernel_huawei_hi6210sft/commits/a02618c9b3b4bc090c80fa6867aa27ab8d83b066"},{"sha":"0888334e6e61797e392b1b4feb1b4cab25785d2c","author":{"name":"hak86","email":"44f412f43d2240ce07a904776141162f53c1f606@gmail.com"},"message":"selinux/nlmsg: add XFRM_MSG_MAPPING\n\ncommit bd2cba07381a6dba60bc1c87ed8b37931d244da1 upstream (net-next).\n\nThis command is missing.","distinct":true,"url":"https://api.github.com/repos/hak86/android_kernel_huawei_hi6210sft/commits/0888334e6e61797e392b1b4feb1b4cab25785d2c"},{"sha":"7d283992a3e5d5c2c33513d351507481cc4b84ab","author":{"name":"hak86","email":"44f412f43d2240ce07a904776141162f53c1f606@gmail.com"},"message":"selinux: add SOCK_DIAG_BY_FAMILY to the list of netlink\n message types\n\ncommit 6a96e15096da6e7491107321cfa660c7c2aa119d upstream.\n\nThe SELinux AF_NETLINK/NETLINK_SOCK_DIAG socket class was missing the\nSOCK_DIAG_BY_FAMILY definition which caused SELINUX_ERR messages when\nthe ss tool was run.\n\n # ss\n Netid  State  Recv-Q Send-Q  Local Address:Port   Peer Address:Port\n u_str  ESTAB  0      0                  * 14189             * 14190\n u_str  ESTAB  0      0                  * 14145             * 14144\n u_str  ESTAB  0      0                  * 14151             * 14150\n {...}\n # ausearch -m SELINUX_ERR\n ----\n time->Thu Jan 23 11:11:16 2014\n type=SYSCALL msg=audit(1390493476.445:374):\n  arch=c000003e syscall=44 success=yes exit=40\n  a0=3 a1=7fff03aa11f0 a2=28 a3=0 items=0 ppid=1852 pid=1895\n  auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0\n  tty=pts0 ses=1 comm=\"ss\" exe=\"/usr/sbin/ss\"\n  subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)\n type=SELINUX_ERR msg=audit(1390493476.445:374):\n  SELinux:  unrecognized netlink message type=20 for sclass=32","distinct":true,"url":"https://api.github.com/repos/hak86/android_kernel_huawei_hi6210sft/commits/7d283992a3e5d5c2c33513d351507481cc4b84ab"},{"sha":"0cd29c4973a8b26251f132a73ca8294e35acee2c","author":{"name":"hak86","email":"44f412f43d2240ce07a904776141162f53c1f606@gmail.com"},"message":"SELinux: use deletion-safe iterator to free list\n\nThis code is not exercised by policy version 26, but will be upon\nupgrade to policy version 30.","distinct":true,"url":"https://api.github.com/repos/hak86/android_kernel_huawei_hi6210sft/commits/0cd29c4973a8b26251f132a73ca8294e35acee2c"},{"sha":"3db962eb3cf4f2809d78ebccbcab4082d21586de","author":{"name":"hak86","email":"44f412f43d2240ce07a904776141162f53c1f606@gmail.com"},"message":"SELinux: ss: Fix policy write for ioctl operations\n\nSecurity server omits the type field when writing out the contents of the\navtab from /sys/fs/selinux/policy. This leads to a corrupt output. No impact\non the running kernel or its loaded policy. Impacts CTS neverallow tests.","distinct":true,"url":"https://api.github.com/repos/hak86/android_kernel_huawei_hi6210sft/commits/3db962eb3cf4f2809d78ebccbcab4082d21586de"},{"sha":"0418bc7ea5384525de75bfcc8d3b2d365c2d4fd6","author":{"name":"hak86","email":"44f412f43d2240ce07a904776141162f53c1f606@gmail.com"},"message":"selinux: enable per-file labeling for debugfs files.\n\nupstream commit 6f29997f4a3117169eeabd41dbea4c1bd94a739c\n\nAdd support for per-file labeling of debugfs files so that\nwe can distinguish them in policy.  This is particularly\nimportant in Android where certain debugfs files have to be writable\nby apps and therefore the debugfs directory tree can be read and\nsearched by all.\n\nSince debugfs is entirely kernel-generated, the directory tree is\nimmutable by userspace, and the inodes are pinned in memory, we can\nsimply use the same approach as with proc and label the inodes from\npolicy based on pathname from the root of the debugfs filesystem.\nGeneralize the existing labeling support used for proc and reuse it\nfor debugfs too.\n\n[sds:  Back-ported to 3.10.  superblock_security_struct flags field\nis only unsigned char in 3.10 so we have to redefine SE_SBGENFS.\nHowever, this definition is kernel-private, not exposed to userspace\nor stored anywhere persistent.]","distinct":true,"url":"https://api.github.com/repos/hak86/android_kernel_huawei_hi6210sft/commits/0418bc7ea5384525de75bfcc8d3b2d365c2d4fd6"},{"sha":"8aad34aa62f032dfd743b43c8ac213590ca8d53f","author":{"name":"hak86","email":"44f412f43d2240ce07a904776141162f53c1f606@gmail.com"},"message":"selinux: enable genfscon labeling for sysfs and pstore files\n\nSupport per-file labeling of sysfs and pstore files based on\ngenfscon policy entries.  This is safe because the sysfs\nand pstore directory tree cannot be manipulated by userspace,\nexcept to unlink pstore entries.\nThis provides an alternative method of assigning per-file labeling\nto sysfs or pstore files without needing to set the labels from\nuserspace on each boot.  The advantages of this approach are that\nthe labels are assigned as soon as the dentry is first instantiated\nand userspace does not need to walk the sysfs or pstore tree and\nset the labels on each boot.  The limitations of this approach are\nthat the labels can only be assigned based on pathname prefix matching.\nYou can initially assign labels using this mechanism and then change\nthem at runtime via setxattr if allowed to do so by policy.","distinct":true,"url":"https://api.github.com/repos/hak86/android_kernel_huawei_hi6210sft/commits/8aad34aa62f032dfd743b43c8ac213590ca8d53f"},{"sha":"34009e2bbc69ff9f96d8c4b65bfa6c29fa1d0d5d","author":{"name":"hak86","email":"44f412f43d2240ce07a904776141162f53c1f606@gmail.com"},"message":"selinux: do not check open perm on ftruncate call\n\nUse the ATTR_FILE attribute to distinguish between truncate()\nand ftruncate() system calls. The two other cases where\ndo_truncate is called with a filp (and therefore ATTR_FILE is set)\nare for coredump files and for open(O_TRUNC). In both of those cases\nthe open permission has already been checked during file open and\ntherefore does not need to be repeated.\n\nCommit 95dbf739313f (\"SELinux: check OPEN on truncate calls\")\nfixed a major issue where domains were allowed to truncate files\nwithout the open permission. However, it introduced a new bug where\na domain with the write permission can no longer ftruncate files\nwithout the open permission, even when they receive an already open\nfile.\n\n(cherry picked from commit b21800f304392ee5d20f411c37470183cc779f11)","distinct":true,"url":"https://api.github.com/repos/hak86/android_kernel_huawei_hi6210sft/commits/34009e2bbc69ff9f96d8c4b65bfa6c29fa1d0d5d"}]}
{"actor":{"display_login":"hak86"}}